Restrict SCML player protocol

[Muhtasham]

Summary

• replace native SCML OneShotAgent submissions with a restricted decide(observation) policy function
• keep SCML world objects, trusted wrapper agents, offer/response validation, scoring, and result-file handling inside the arena runtime
• run submitted policies in isolated worker processes with per-decision timeouts and max_policy_errors fallback disabling
• switch SCML worlds to a two-process setup so submitted policies actually participate in buy/sell negotiations
• update starter code, docs, example config, validation, and tests for the restricted protocol

Verification

• uv run ruff check codeclash/arenas/scml/scml.py codeclash/arenas/scml/runtime/run_scml.py tests/arenas/test_scml.py
• uv run pytest -q tests/arenas/test_scml.py -> 10 passed
• uv run pytest -q tests/arenas -> 190 passed
• uv run pre-commit run --files codeclash/arenas/scml/scml.py codeclash/arenas/scml/runtime/README.md codeclash/arenas/scml/runtime/scml_agent.py codeclash/arenas/scml/runtime/run_scml.py configs/examples/SCML__dummy__r1__s2.yaml docs/reference/arenas/scml.md tests/arenas/test_scml.py
• docker build -t codeclash/scml -f codeclash/arenas/scml/SCML.Dockerfile .
• direct Docker starter smoke: two sims completed; all details had nonzero decisions, zero policy_errors, zero invalid_decisions, and zero disabled_policies
• direct Docker invalid-output smoke: invalid offers/responses were rejected, logged as invalid_decisions, and the world completed using trusted fallback behavior
• direct Docker infinite-loop smoke: looping policies hit per-decision timeout, were disabled after max_policy_errors, and the world completed using trusted fallback behavior
• uv run python main.py configs/examples/SCML__dummy__r1__s2.yaml -o /private/tmp/codeclash-scml-protocol.sFesGl -> two launcher rounds completed, both players validated, details had active policy decisions and zero policy errors
• uv run pytest -q -> 192 passed